Abstract:
Software-defined networking architectural framework eases the life of the network administrators by isolating the data plane from the control plane. This facilitates easyconfigurationofthenetwork,providesaprogrammableinterfacefordeveloping applicationsrelatedtomanagement,security,loggingetc. andthecentralizedlogical controller gives more control over the entire network, which has the total visibility of the network. These advantages of SDN also expose the network to the vulnerabilities and the impact of the attacks are much severe when compared to conventional networks, where the network devices in itself provided protection from the attacks and limits the scope of the attacks. In this paper, we explore various attacks that can be launched on SDN at different layers. We also evaluate some of the existing security methods in mitigating the attacks. We also explore a possible solution to prevent DDoS attacks using entropy. A Distributed Denial of Service (DDoS) attack is a DoS attack utilizing multiple distributed attack sources. Every network in the system has an entropy. Increase in randomness causes decrease in entropy. To mitigate this threat, this project proposes to use the central control of SDN for attack detection and introduces a solution that is effective and lightweight in terms of the resources that it uses. Moreprecisely,thisprojectshowshowDDoSattackscanexhaustcontrollerresources and provides a solution to detect such attacks based on the entropy variation of the destination IP address. Based on this value if it drops below threshold , we are blocking the specific port in the switch and bring the port down. This method is able to detect DDoS within the first five hundred packets of the attack traffic.
